Question

avastuser3796 · January 3, 2014, 12:52am

Hi, I do malware sampling with Steven and Polonus. I found 15 undetected files all for Linux. Where do I report them and too who? I’m using Avast! for Windows. So that’d be useless.

Asyn · January 3, 2014, 4:30pm

Report them to: virus[at]avast.com

avastuser3796 · January 3, 2014, 6:13pm

That’s what I thought. Thanks Asyn

Asyn · January 3, 2014, 6:40pm

You’re welcome.

system · January 5, 2014, 1:43pm

That’s a lot of Linux specific malware.

Do you think you could also submit them to virustotal and post back the links so that we can see what and who is detecting?

Thanks

avastuser3796 · January 5, 2014, 2:12pm

Hi Mag,

As I am not at my primary machine and on a very unsecure system right now I cannot. Steven Winderlich asked for the DL and to do Malware Analysis. He might be able to post VT links. If not It’ll take me 2ish hours to get them for you.

Note: As I am not familiar with Linux malware, I don’t know what an “exe” file is in comparison to windows. So the rest of the files might just be random files.

Secondmineboy · January 5, 2014, 2:49pm

Here are Virustotal Links:

Last one is just a text filw with an IP in it.
IP Scan: https://www.virustotal.com/de/url/580cef0b6d5c984a99a111d960a6a33bad324efc1a76ed92ee911601ee53cdf6/analysis/1388933253/

system · January 5, 2014, 3:51pm

Many thanks for taking the time to do this.

Secondmineboy · January 5, 2014, 3:53pm

No problem.

These are script files i think, so they are executed in Terminal or via browser.
Or maybe with some else program. Cant get them to run here under Ubuntu 13.10 with latest updates.

Secondmineboy · January 5, 2014, 4:06pm

One of the malware files is running in memory. (Screenshot)

Also Ubuntu is unable to connect to my GMail Account. (Screenshot)

system · January 5, 2014, 7:49pm

I’m no malware expert, but when I come across references to linux malware I try to check to see which scannners detect it. This sample doesn’t imply any reason to switch from my current scanner (comodo).

Thanks again.

Abraxas · January 12, 2014, 8:39pm

I think you’ll find you have a bunch of False Positives.
(EDIT:Steven Winderlich I take it you’re running windows, and Ubuntu as a Dual Boot setup, and have scanned your Linux partition with Avast! for Windows ?
Try installing the Linux scanner into Ubuntu, and running it.
It’s very uncommon to have anything but ‘Windows’ viruses in Linux, which are harmless, and can be simply cleaned using Avast4Linuxworkstations. )
Regards,

Tony.

This is a problem relating to a URL we had a while back.

The best action to take is described in my quote:
http://forum.avast.com/index.php?topic=141439.msg1032132#msg1032132

Abraxas post:3:

When faced with your Web site being deemed to contain Malware, or a problem with Avast! (generally for Windows) blocking access to your site please report it immediately to Avast! Support [AVAST Software a.s.] https://support.avast.com/Tickets/Submit/RenderForm

I found their direct intervention the quickest way to resolve such issues, the forum next to useless.

Choose your Problem
Submit a Ticket
Get a direct and fast response.

Having a site blocked needs to be quickly remedied, it may cost you customers, exposure, etc. as is reasonable to expect.
The Direct approach I found technically pertinent in clearing the instance of a False Positive.
Using the Avast Support Forum cost time, lots of it, and custom.

I hope this may help others who may have a problem, as I once did .

Secondmineboy · January 24, 2014, 10:10pm

Hi Abraxas,

no this is a virtual machine created with virtualbox, i would never ruzn Linux Malware on a dualboot system.

But maybe i will set up a Linux system like OpenSUSE or something
on my grandpas computer and maybe i will head over to linux too. But im not sure yet.

Abraxas · January 26, 2014, 7:49pm

Hi Steven Winderlich,

you may have confused some issues raised by the OP.
alan1998:

Hi, I do malware sampling with Steven and Polonus. I found 15 undetected files all for Linux. Where do I report them and too who? I'm using Avast! for Windows. So that'd be useless.

Note: As I am not familiar with Linux malware, I don't know what an "exe" file is in comparison to windows. So the rest of the files might just be random files.

To clarify that statement, linux does not use 'exe' files. This whole post is rather confused and misleading: Statements such as Linux Malware need to be backed up with a running Linux DE, stating found Malware, and why it is thought to be Linux Malware, which is quite an involved task. Much moreso than processing what is known Windows Malware ;)

I believe what you’re seeing is Windows Malware, running in virtualbox, in or your Host Windows.

All viruses found by us running on our Linux DE’s are Windows viruses, which are unable to execute, as they are based on an"exe" file, which don’t run in linux.

The main purpose of running a Virus scanner like Avast!4linuxworkstations is so as not to transmit windows executable malware from a Linux system, to a friend who is using Windows. Transmission can be made via Email, or file sharing, etc.

Best Regards,

Abraxas

avastuser3796 · February 7, 2014, 6:49pm

Abraxas post:14:

Hi Steven Winderlich,

you may have confused some issues raised by the OP.
alan1998:

Hi, I do malware sampling with Steven and Polonus. I found 15 undetected files all for Linux. Where do I report them and too who? I'm using Avast! for Windows. So that'd be useless.

Note: As I am not familiar with Linux malware, I don't know what an "exe" file is in comparison to windows. So the rest of the files might just be random files.
To clarify that statement, linux does not use 'exe' files. This whole post is rather confused and misleading: Statements such as Linux Malware need to be backed up with a running Linux DE, stating found Malware, and why it is thought to be Linux Malware, which is quite an involved task. Much moreso than processing what is known Windows Malware ;)
I believe what you’re seeing is Windows Malware, running in virtualbox, in or your Host Windows.

All viruses found by us running on our Linux DE’s are Windows viruses, which are unable to execute, as they are based on an"exe" file, which don’t run in linux.

The main purpose of running a Virus scanner like Avast!4linuxworkstations is so as not to transmit windows executable malware from a Linux system, to a friend who is using Windows. Transmission can be made via Email, or file sharing, etc.

Best Regards,

Abraxas

Re-Read what I said again. I said "I don’t know what an “exe” file in comparison to Linux is.

Some file must have the properities to be luanched right? Whatis that file extension? Windows is .exe or .jar.

Hence, I don’t know if it’s malware. 3 of the files where detected already. It came inside a ZIP folder into my Windows PC. They were included. Like for FRST to run a fixlist. It has to be in the same location.

Also, why did you bring back an old thread when it had aslready been dealt with?

Abraxas · February 8, 2014, 7:17am

Re-Read what I said again. I said "I don't know what an "exe" file in comparison to Linux is. Some file must have the properities to be luanched right? Whatis that file extension? Windows is .exe or .jar.
Hence, I don’t know if it’s malware. 3 of the files where detected already. It came inside a ZIP folder into my Windows PC. They were included. Like for FRST to run a fixlist. It has to be in the same location.

Lets make it really simple: There has not been as yet any Linux Malware. As I said, what is found on Linux is Windows Malware.

Also, why did you bring back an old thread when it had aslready been dealt with?

In what manner was it dealt ? Did you contact as I suggested: Avast! Support [AVAST Software a.s.] https://support.avast.com/Tickets/Submit/RenderForm

Sorry, we can’t have such a slow sub-Forum as this with pending problems. I get a RSS feed, I make a suggestion, a certain amount of time goes by, you hadn’t confirmed your findings with the Avast! Engineer, so I had to try to draw the conclusion.

Be very assured, as I say for the third time there are no widespread Linux Malware. We Scan to find Windows Malware, so as not to transmit what is as you’d kno already epidemic Windows Malware.

Best Regards,

Abraxas. pclinuxos.com

avastuser3796 · February 8, 2014, 5:08pm

Hi, do you work for Avast!? I contacted them with that. Can you explain with Avast! detected them as ELF and UNIX malware? I’d sure like to know, as that isn’t windows.

http://en.wikipedia.org/wiki/Executable_and_Linkable_Format

Can you explain Malwarebytes reply to me reporting it?

https://forums.malwarebytes.org/index.php?showtopic=139571#entry772499

"Malwarebytes doens’t run on LINUX or UNIX thus making it look like LINUX malware. Not windows.

Abraxas · February 9, 2014, 12:35pm

Michael (alan1998), hey there.
With respect, I’m having trouble following you. First, I’ve never even heard of any spyware that affects Linux.
Linux is a very Secure Operating System.
Read this: http://www.linuxclues.com/articles/21.htm

Hi, do you work for Avast!? I contacted them with that. Can you explain with Avast! detected them as ELF and UNIX malware? I'd sure like to know, as that isn't windows.

An Avast Engineer must analyse your submissions, as the Avast Scanner made the discovery, and report to you their findings, if that's happened please post said report so we may all peruse what they had to say. Thanks. :D

Can you give any example of the Malware you had on your System, and what it tried to do to your system. Did it report info to a IP address, or alter any System settings, or permissions ?

Please be patient, as Windows users we see Malware everywhere. It’s certainly not the case with a Linux Desktop.
New Linux users just can’t seem to shake the paranoia associated with Windows. But, they soon learn, that the rules are simply different using Linux as opposed to Windows.

You ask how does a programme start in Linux ? Simply, you call it by its name.
Say I want to start Firefox, I would open a Terminal, and type in ’ firefox %u '.
That will launch firefox. Or I can create a ‘Launcher’, like a Windows Shortcut.
But I do so as a User, with restricted permissions, not as root, (Admin) which is the basis of Linux.
Not leaving a door open for a hacker to enter.

I suggest going to some Linux Forums with your Malware. I’ve never come across any so I’m of little help, next to useless really.
I searched this Forum, “Linux Malware” :

http://myphotos.mypclinuxos.com/images/Abraxas012X/linuxmalware.png

I did a little searching: Have you ever had or suspected malware to be on your Linux system?
http://www.linux.org/threads/malware-and-antivirus-systems-for-linux.4455/page-2#post-14801

Also VirusTotal states with all the files I checked: "Probably harmless! There are strong indicators suggesting that this file is safe to use. " :

What is VirusTotal
"VirusTotal, a subsidiary of Google, is a free online service that analyzes files and URLs enabling the identification of viruses, worms, trojans and other kinds of malicious content detected by antivirus engines and website scanners. At the same time, it may be used as a means to detect false positives, i.e. innocuous resources detected as malicious by one or more scanners.

"As previously stated, VirusTotal also aggregates the output of a number of file and URL characterization tools. These tools cover a wide range of purposes, ranging from providing structural information about Microsoft Windows portable executables (PEs) to identifying signed software.
"VirusTotal: second opinion, not a product substitute

VirusTotal is not a substitute for any antivirus/security software installed in a PC, since it only scans individual files/URLs on demand. It does not offer permanent protection forusers’ systems either. At VirusTotal we think of our service as a second opinion regarding the maliciousness of your files/URLs.

Although the detection ratio achieved by the use of multiple antivirus engines/URL scanners is far superior than that offered by just one product, these results DO NOT guarantee the harmlessness of a file/URL. Moreover, the aggregate amount of false positives of multiple solutions is higher than that of any individual scanner…"

I have not a lot more to say.
This Sub-Forum is for the Avast4Linuxworkstations, and other Server Scanners provided by Avast.

Read the Forum, it isn’t at all like the Avast Windows Forums. In fact it’s basically a dead horse as far as activity, dynamics, and innovation. http://forum.avast.com/index.php?topic=120603.0

But it is a gateway to Avast for linux scanners.

Any reporting of viruses will need to be sent to the already meantioned;
Avast! Support [AVAST Software a.s.] https://support.avast.com/Tickets/Submit/RenderForm

Best Regards,

Abraxas

Question

Announcements